Download Qanum

Release v0.9.0

Released on 17 October 2026. It is the first public release and runs the public testnet; no mainnet genesis exists yet. Every release publishes:

• qanum-l1-v0.9.0-20261017.tar.gz — the source tarball;
• qanum-core-0.9.0.cdx.json and qanum-embed-0.9.0.cdx.json — CycloneDX software bills of materials;
• qanum-security-0.9.0.json — the security facts of the release (signature suites, P2P transport, release keys, toolchain, liboqs, cargo audit result);
• SHA512SUMS — the SHA-512 of every file above;
• SHA512SUMS.qsig — two post-quantum signatures of that list (ML-DSA-87 and SLH-DSA-SHAKE-256s);
• SHA512SUMS.asc — a classical PGP signature, for compatibility with standard tools.

The files are published with the release in the source repository and become downloadable when it opens to the public. Until then, write to partnerships@qanum.org to request access.

Requirements

64-bit only. Qanum targets 64-bit platforms (x86_64 and aarch64). 32-bit platforms are not supported: consensus values and amounts are u64/usize, and some edge cases are only safe on 64-bit.

Rust toolchain — install it with rustup. The compiler is pinned in rust-toolchain.toml (currently 1.98.1); inside the source tree rustup selects and installs it automatically.

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
source "$HOME/.cargo/env"
rustc --version

System packages (Ubuntu/Debian), needed to build liboqs from source:

sudo apt update
sudo apt install build-essential clang libclang-dev cmake pkg-config \
                 libc6-dev linux-libc-dev libssl-dev

Build from source

From the unpacked source tarball (or a clone of the repository once it is public):

# Full node with real post-quantum signature verification. This is the only
# kind of build: qanum-core does not compile without liboqs.
cargo build --release --features crypto-oqs

# Install qanumd and qanum-cli into ~/.cargo/bin
cargo install --path . --features crypto-oqs

Signatures are verified with the NIST-standardized algorithms through liboqs on every network. At startup the node runs a known-answer self-test of every signature suite and refuses to start if it fails; no build or flag skips signature checks.

Run a testnet node

./target/release/qanumd \
  -chain=testnet \
  --datadir="$HOME/.qanum/testnet" \
  --rpcuser=user --rpcpassword=pass \
  --strict-full --verifier oqs \
  -gen=1 --mining-interval-ms=500

Connect a second node (follower):

./target/release/qanumd \
  -chain=testnet \
  --datadir="$HOME/.qanum/testnet-b" \
  --rpcuser=user --rpcpassword=pass \
  --strict-full --verifier oqs \
  -addnode=<ip-of-node-a>:18445

Interact through the CLI:

./target/release/qanum-cli --network=testnet --addr=127.0.0.1:18338 \
  --rpcuser=user --rpcpassword=pass getblockcount

./target/release/qanum-cli --network=testnet --addr=127.0.0.1:18338 \
  --rpcuser=user --rpcpassword=pass getnewaddress

Run as a systemd service

The source tree ships a hardened unit at contrib/systemd/qanumd.service:

# 1) Create the service user
sudo useradd --system --create-home --shell /usr/sbin/nologin qanum

# 2) Install the binaries for that user
sudo -u qanum cargo install --path /path/to/qanum --features crypto-oqs

# 3) Install and enable the unit
sudo cp contrib/systemd/qanumd.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now qanumd

# 4) Follow the logs
journalctl -u qanumd -f

The unit runs qanumd as an isolated qanum user with security hardening (ProtectSystem=strict, NoNewPrivileges, PrivateTmp, restrictive UMask), writes only to /home/qanum/.qanum, restarts on failure and logs to the journal. systemctl stop triggers an orderly shutdown that flushes the chainstate.

Configuration

qanumd loads ~/.qanum/qanum.conf automatically (every key is optional; command-line flags take precedence). A commented template, qanum.conf, ships in the source tree. It covers network selection, the P2P port, DNS seeds, RPC, sync mode, optional mining, static peers, the transaction and address indexes, and pruning. Every option is described in the configuration reference.

Networks and ports

Verify a release

SHA512SUMS.qsig carries two post-quantum signatures, ML-DSA-87 (FIPS 204) and SLH-DSA-SHAKE-256s (FIPS 205). Both must verify: they rest on unrelated mathematics, so breaking one scheme is not enough to forge a release. The PGP signature is classical (not quantum-resistant) and is provided for compatibility only; the post-quantum signatures are authoritative.

With a qanum-cli you already trust (works offline, no node needed):

qanum-cli verifyrelease <directory-with-the-downloaded-files>

First download, with no trusted qanum-cli yet: compare the release key ids below with the ones in docs/SECURITY.md, check the PGP signature and the checksums, then build the release and run verifyrelease on the same files:

gpg --verify SHA512SUMS.asc SHA512SUMS
sha512sum -c SHA512SUMS

Release signing keys

The keys were generated offline on 11 October 2026 and their secret halves never leave an offline machine. PGP key (Qanum Security, security@qanum.org), fingerprint 8013 E1BF F91C A30E E6A5 F273 01D9 6226 80BA FCA9, on keys.openpgp.org.